Searching for the most accessed pages by user

We can modify the search from this recipe and can use the distinct count (dc) function of the stats command to display a list of users and the unique pages they visited:

sourcetype=access_combined index=main | stats dc(uri_path) by user | sort - user 

The distinct count function ensures that if a user visits the same page multiple times, it is only counted as one visit. The user who visited the most number of unique pages will be at the top of the list, as we used a descending sort.

For more information on the various functions that can be used with the stats command, please check out https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonStatsFunctions.

Get Splunk Operational Intelligence Cookbook - Third Edition now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.